topic Re: How to compare the .conf consistency across all nodes in a SHC ? in Deployment Architecture

How to compare the .conf consistency across all nodes in a SHC ?

Glasses2 — Fri, 10 Feb 2023 19:24:02 GMT

Hi,

Does anyone have a method or an app or query that can check and compare the confs between all SHC members?

Perhaps there is a way with btool or rysnc.

I was given a PS Tech Assessment App but it is not working correctly. I don't think the PS Tech knew how to install it or use it.

Thank you

Re: How to compare the .conf consistency across all nodes in a SHC ?

gcusello — Sat, 11 Feb 2023 06:34:26 GMT

Hi @Glasses2 ,

whwy do you want to compare conf files between SHC members?

All apps are replicated between them the only differences can be in $SPLUNK_HOME/etc/system/local.

Anyway, to extract configurations using btool it could be a good and easy approach.

in addition there's an app (sincerely that I never used!) called "Conf Inspactor" (https://splunkbase.splunk.com/app/3957) that probably solves your need.

Ciao.

Giuseppe

Re: How to compare the .conf consistency across all nodes in a SHC ?

Glasses2 — Mon, 13 Feb 2023 14:20:00 GMT

@gcusello

Thank you for the reply and suggestion.

I agree with you about replication, however in my case, the shc was not replicating correctly. The previous admin did not know what he was doing and others were restarting shc nodes individually causing corruption.

Specifically I was seeing transforms in the search app that were not replicating correctly. As well the lookups were different across the shc nodes.

Its a real mess!

The PS assessment app has a conf checker but it is not working correctly and is probably missing a dependency. I will try you suggestion and get back to you. TY!

Re: How to compare the .conf consistency across all nodes in a SHC ?

gcusello — Mon, 13 Feb 2023 14:24:39 GMT

Hi @Glasses2,

using btool you can identify differences in conf file, not differences in lookups, so maybe it could be a good idea to take all lookups, consolidate them in on lookup.

Then, for Conf files, take all the configurations using btool and consolidate them in a new app version for each app, then push apps and lookups from the Deployer.

Let me know if I could help you more.

Ciao.

Giuseppe

Re: How to compare the .conf consistency across all nodes in a SHC ?

Glasses2 — Mon, 13 Feb 2023 15:47:45 GMT

Admins Little Hepler for Splunk seems to work

https://splunkbase.splunk.com/app/6368

Re: How to compare the .conf consistency across all nodes in a SHC ?

gcusello — Mon, 13 Feb 2023 16:17:20 GMT

Hi @Glasses2,

good for you, anyway, when you'll consolidate your apps and lookups, deploy them again from the Deployer to have a clean configuration.

Ciao.

Giuseppe

Re: How to compare the .conf consistency across all nodes in a SHC ?

Glasses2 — Mon, 13 Feb 2023 16:31:23 GMT

the conf-inspector has less functionality

https://splunkbase.splunk.com/app/3957